HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your site, preventing downgrade attacks. Enable it only after SSL is working and HTTPS is forced, since mistakes can lock browsers out of the HTTP version.
Add this to your .htaccess in public_html:
- Open File Manager and edit
.htaccess. - Add:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Start with a short max-age (like 300) to test, then increase to a year once everything works. Add preload only if every subdomain has valid SSL and you intend to submit to the browser preload list. Test in a private window. If your server uses LiteSpeed and the header doesn't appear, open a ticket and we'll help confirm it's set correctly.
